CVE-2024-47806: High severity jenkins openid connect authentication plugin vulnerability
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a1de8 and earlier does not check the aud (Audience) claim of an ID Token during its authentication flow, a value to verify the token is issued for the correct client.
This vulnerability may allow attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
OpenId Connect Authentication Plugin 4.355.v3afbfcab96d4 checks the aud (Audience) claim of an ID Token during its authentication flow.
Other sources
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a1de8 and earlier does not check the aud (Audience) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47806?
CVE-2024-47806 has a medium severity level due to its potential to subvert authentication processes.
How do I fix CVE-2024-47806?
To fix CVE-2024-47806, upgrade the Jenkins OpenId Connect Authentication Plugin to version 4.355.v3a or later.
What types of systems are affected by CVE-2024-47806?
CVE-2024-47806 affects Jenkins installations using versions of the OpenId Connect Authentication Plugin up to 4.354.v321ce67a_1de8.
What is the main issue with CVE-2024-47806?
The main issue with CVE-2024-47806 is that it does not validate the 'aud' claim in the ID Token, potentially allowing token misuse.
Can CVE-2024-47806 be exploited remotely?
Yes, CVE-2024-47806 can be exploited remotely if an attacker has the ability to issue a valid ID Token without the appropriate audience validation.